docs: add SECURITY.md vulnerability disclosure policy - #225

Adds a SECURITY.md so vulnerability reports have a private channel and a clear place to land, and so a few intentional design tradeoffs are stated as policy rather than getting re-reported as bugs.

There is currently no security policy in the repo. GitHub surfaces SECURITY.md in the Security tab and the "Report a vulnerability" flow.

What's in it

• Private reporting via GitHub's built-in private vulnerability reporting (no infrastructure to stand up, just needs enabling under Settings > Security > Advisories), with "contact a maintainer directly" as a fallback.
• Supported versions: fixes land on the latest release, older images unmaintained.
• Scope / known limitations (the useful-for-this-project part): secrets stored unencrypted on flash (WiFi passwords, Nostr keys, NWC secrets), no app sandboxing, physical access = compromise, single-origin OTA over HTTPS with no separate image signing, and the optional settings webserver. All verified against the code.
• In scope: remote code/secret/crash issues without physical access, crypto-handling flaws, malicious-server/relay compromise, OTA push by anyone other than the update server.

Maintainer, please adjust before merging

Deliberately left generic so you can set your own preferences (no name or contact hardcoded):

• Enable GitHub private vulnerability reporting, and/or add a security contact email (there's an HTML comment marking the spot).
• The acknowledgement window is set to "within a week"; change if you'd rather commit to something else.

Happy to adjust wording or scope. If you'd rather not have a formal policy at this stage, no problem, feel free to close.